带字符串的MYSQL查询请参阅数据库中的值

Question

I have MYSQL query like the below:

$sourcedata = mysql_fetch_array(
                mysql_query("SELECT Whereclause 
                               FROM generaltable 
                              WHERE ID = '1'"
                           )
                );

$Whereclause = $sourcedata['Whereclause'];

In "Whereclause" field from "generaltable" in database, consist of the below text:

WHERE username = '$_SESSION[username]'

Then I have other query:

$data = mysql_fetch_array(
                   mysql_query("SELECT * 
                                  FROM usertable 
                                       $Whereclause"
                              )
                        );

When I echo $data['username'], it is not showing anything.

If I copy the value from database to replace $Whereclause it is working fine, also if I replace '$_SESSION[username]' with 'admin' for example, it is working fine.

How can I solve this? Need your help please.

Thank you very much.

Answer 1

The problem you're having is that $Whereclause is a String, so it is not evaluated ('$_SESSION[username]' remains exactly as it is).

You have to tell PHP to evaluate this string with the function eval():

$data = mysql_fetch_array(
          mysql_query(
           eval("return \"SELECT * FROM usertable $Whereclause\";")
         )
        );